MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f3376b143361d7e47b287b1408a18398c729c8c2b5636a8fe23f9f60d78921a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2f3376b143361d7e47b287b1408a18398c729c8c2b5636a8fe23f9f60d78921a
SHA3-384 hash: 0881422bbae8d83f6681db624f53691600dc877521555779fd92a21156a35067fed54571a31585b5a7f47fee732cffdc
SHA1 hash: 150fd61c8002ec32fca75c90d9d8d5b257f3c339
MD5 hash: 2b8fb3e25c74efbec5f636950fd25964
humanhash: sodium-cola-august-dakota
File name:PO.zip
Download: download sample
Signature Loki
Create hunting rule
File size:978'530 bytes
First seen:2020-04-29 18:36:44 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:IY3VMA3PwGSqq8ZoBUJ9Yi+/rR8VPBrZ7aBp0TPgXYYMXw01FRdGMX7:IYOcq8ZoBUJGBy3rZMp0TYi91FPG8
TLSH AD2533009C6A96D1DF9FC1416798F10BBD329BA40B2A0D2B087746FA47A229FCB4FD51
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: monta.com
Sending IP: 94.177.240.87
From: jeffrey@howtoforge.com
Subject: Fwd: Bank Swift/TT Copy
Attachment: PO.zip (contains "tt copy.exe")

Loki C2:
http://mecharnise.ir/da4/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21750.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-29 19:35:58 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
31 of 48 (64.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=f4zxnmkdgyox4r5sq6yubcqyhgghfhemfnldnkh6ep47mdlysina._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 2f3376b143361d7e47b287b1408a18398c729c8c2b5636a8fe23f9f60d78921a

(this sample)

Loki

Executable exe 7d39eb29d6c1e5680f976e6d09445a59230379aac876427e9f2039548acb400f

  
Dropping
MD5 8acf9f79d1071d5057bd29ec2d0dd49f
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7d39eb29d6c1e5680f976e6d09445a59230379aac876427e9f2039548acb400f

Comments